app.js

var express = require('express')
  , bodyParser = require('body-parser')
  , cookieParser = require('cookie-parser')
  , session      = require('express-session');
var passport = require('passport')
  , LocalStrategy = require('passport-local').Strategy;

var app = express();

app.use(express.static('public'));
app.use(cookieParser());
app.use(bodyParser());
app.use(session({ secret: 'super top secret secret' }));
app.use(passport.initialize());
app.use(passport.session());

var router = express.Router();

app.set('views', __dirname + '/views');
app.set('view engine', 'html');
app.engine('html', require('hbs').__express);

passport.use(new LocalStrategy(
  function(username, password, done) {
    User.findOne({ username: username }, function (err, user) {
      if (err) { return done(err); }
      if (!user) {
        return done(null, false, { message: 'Incorrect username.' });
      }
      if (!user.validPassword(password)) {
        return done(null, false, { message: 'Incorrect password.' });
      }
      return done(null, user);
    });
  }
));

passport.serializeUser(function(user, done) {
  done(null, user.id);
});

passport.deserializeUser(function(id, done) {
  User.findById(id, function(err, user) {
    done(err, user);
  });
});

router.post('/login', function(req, res) {
    passport.authenticate('local', { successRedirect: '/',
                                   failureRedirect: '/login',
                                   failureFlash: true })
});

router.post('/', function(req, res) {
    res.render('index');
});

app.use('/', router);

var port = 3000;
app.listen(port);
console.log('Magic happens on port ' + port);